Privacy Policy

Effective date: 2026-09-02 Last updated: 2026-09-02

⚠️ Beta — pending legal review. This document is a draft provided for transparency during our beta. It is under review by legal counsel and may change before general availability.

1600978 B.C. LTD., carrying on business as Oghmere ("Oghmere", "we", "us", or "our"), a company incorporated in British Columbia, Canada, respects your privacy. This Privacy Policy explains what personal information we collect through the Oghmere platform and related websites, applications, and services (the "Service"), how we use and disclose it, and the choices and rights you have.

We handle personal information in accordance with British Columbia's Personal Information Protection Act (PIPA) and, where applicable, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). This Policy is part of, and incorporated into, our Terms of Service.

TL;DR — the short version

This summary is provided for convenience only. It is not a legal document and does not replace the full Policy below, which governs in case of any conflict.

What we collect: your account details, the content you create, payment info (handled by Stripe), and usage/log data. (§2)
Writing-activity and document-lineage tracking: we record how you write — session times, word counts, streaks, and how text arrived in a document (typed, pasted, imported) — to power your private progress dashboard and the record of how each document was built. It is on by default and you can switch it off for your whole account or for one project; we never store what you wrote, and you can export or delete the data anytime. (§2g)
Product analytics: we measure how the Service is used — pages viewed, features used, whether a prompt was shown and acted on. On our public website this is done with no cookie and no identifier at all; in the app it is tied to a pseudonymous account id — never your name or email, and never your content. No ads, no ad networks, no cross-site tracking. (§2h, §9)
Why: to run the Service, process your content with AI when you ask, handle payments, support you, and keep things secure. (§3)
We don't sell your data, and we never use your content to train any AI model — ours or anyone else's. The one exception is the optional research/search feature: text you submit to it goes to a third-party search provider (Tavily) that may train on it — opt-in only, and it changes nothing for the rest of your content. (§3, §5)
AI processing: content you run through AI features goes to providers like Anthropic and Google, which may process it in the United States. (§4, §6)
Who sees it: only providers that operate the Service for us, whoever you choose to share with, and authorities where the law requires. (§5)
Where it lives: stored and processed in Canada, the U.S., and other countries where our providers operate. (§6)
Your rights: access, correct, delete, and withdraw consent — just contact our Privacy Officer. (§10)
Age 13+; minors under the age of majority need a parent or guardian's consent. (§11)
Governed by BC's PIPA and federal PIPEDA; you can complain to the OIPC of BC. (§10)

1. Who is responsible for your information

Oghmere is the organization responsible for the personal information under our control. Questions and requests can be directed to our Privacy Officer:

Privacy Officer
1600978 B.C. LTD. (carrying on business as Oghmere)
Suite 1008
3003 Grandview Hwy, Unit 1
Vancouver, BC
Canada
V5M 2E4
Email: privacy@oghmere.com

2. Information we collect

We collect personal information that you provide, that is generated as you use the Service, and that we receive from service providers acting on our behalf.

a. Account and profile information. Name, email address, password (stored in hashed form), and account settings when you register.

b. Your Content. The manuscripts, notes, prompts, files, project data, and other material you create, upload, or generate through the Service. Your Content may itself contain personal information that you choose to include.

c. Payment information. When you purchase Credits or subscriptions, our payment processor (Stripe) collects and processes your payment details. We receive limited billing information (such as transaction records and the last digits/card type) but do not store full payment-card numbers.

d. Usage and device information. Log data such as IP address, browser and device type, pages and features accessed, timestamps, referring URLs, and diagnostic and performance data. This is used to operate, secure, and improve the Service.

e. Communications. Information you provide when you contact us for support, submit feedback, or otherwise communicate with us.

f. Cookies and similar technologies. We use strictly necessary and functional cookies/local storage to keep you signed in and remember preferences. See Section 9.

g. Writing-activity and document-lineage information (on by default; you can turn it off). We collect behavioural information about how you write so we can show you a private progress dashboard, insights, timeline and achievements, and so each document can carry a record of how it was built. Unlike the categories above, this one is not required to run the Service — it exists for your benefit, and you can switch it off at any time without losing access to anything else.

This setting is on by default. We record the version of this Policy in force when you accept it, and turning it off is a single control in Settings → Profile & Account → Writing activity. If you turn it off, it stays off — we do not re-enable it for you, and no later change to our defaults will switch it back on.

What we collect: writing- and revision-session timing (when a session started and ended and its duration), the number of words added or removed in a session, which project or document a session belonged to, your local time-zone offset, per-day aggregates (words written, minutes written, session and revision-session counts, documents touched, stories completed), streak and cadence figures derived from those aggregates, structural counts about a document (such as word and sentence totals), and the achievement badges you unlock.
Document lineage: we also record the mechanics of each change to a document — whether text was typed, pasted, imported or restored, how many characters and words each change added or removed, when it happened, and which Oghmere features ran on the document. These entries are linked together with a hash so the record can be shown not to have been altered after the fact. This is what the Provenance tab on each document describes.
What we do not collect: we never store the text you wrote. No manuscript content, sentences, or characters of Your Content are written to this data — only the numeric and timing measurements above.
Why we collect it: solely to compute and display your own progress, writing habits, and the record of how your own documents were built, back to you. It is not used for advertising, is not sold, is not used to train AI models, is not shared with other users, and is never used to judge, flag, rank, price or report you. We do not treat any of it as evidence about you; it is a record we keep on your behalf and that you control.
Your control: it stays private to your account and is protected by row-level access controls so that only you can see it. You can turn it off for your whole account, or for an individual project — useful when one piece of work is private but the rest is not; new projects also offer the choice as you create them. When you turn it off we stop collecting, and you can delete what was already collected. You can also export it at any time, choose how long we keep it, and delete it outright without turning collection off. Deleting your account also deletes this data (see Section 7).

h. Product-analytics information. We record a small number of events describing how the Service is used — pages viewed, features and AI coaches invoked, accounts created, and whether a prompt or button was shown and acted on — together with the page address, the referring URL, any campaign parameters in the link you arrived from, coarse browser and device information, and your approximate location (country level, derived from your IP address). These events are processed on our behalf by PostHog (Section 5).

On our public website (www.oghmere.com) these events carry no cookie and no persistent identifier. Analytics storage is switched off there, so each visit is counted on its own: we cannot recognise you between visits, and we cannot connect a visit to an account.
In the signed-in application (app.oghmere.com) events are linked to a pseudonymous account identifier so that we can tell one person's session from another's and measure whether a feature actually works. We deliberately do not send your name or your email address to our analytics provider. This uses an analytics cookie and local storage (Section 9).
What we never send: Your Content. No manuscript text, prompts, notes, file contents, or AI output is included in analytics events. Our anonymous try-it surface loads no analytics scripts at all.
Why we collect it: to understand which features are used and where people get stuck, so that we can improve the Service (Section 3(g)). It is not used for advertising and is not sold.

3. How we use your information and our legal basis

Under PIPA, we collect, use, and disclose personal information for purposes a reasonable person would consider appropriate in the circumstances, and with your consent (express or implied) except where the law permits or requires otherwise. We use personal information to:

(a) provide, operate, maintain, and secure the Service and your account; (b) process Your Content through AI models and other service providers to generate the features you request (see Section 4); (c) publish, share, or distribute Your Content only at your direction (for example, when you create a public share page or export Your Content); (d) process payments and manage Credits and subscriptions; (e) provide support, respond to your requests, and communicate service-related notices; (f) monitor, troubleshoot, prevent abuse and fraud, and enforce our Terms; (g) understand usage and improve and develop the Service; (h) unless you have turned it off, compute and show you your own private writing-activity dashboard, insights, timeline, achievements, and the record of how each of your documents was built (Section 2g); and (i) comply with legal obligations and protect our rights and the rights and safety of others.

We rely primarily on your consent, on the necessity of processing to provide a service you have requested, and on our legitimate operational and security needs, as permitted by PIPA. We do not sell your personal information, and we do not use Your Content to train any AI model — ours or anyone else's.

One bounded exception — the research/search surface. The optional research feature works by sending what you type into it to a third-party web-search provider (AlphaAI Technologies Inc. dba Tavily — see Section 5) whose terms permit it to use and train AI models on the text it receives. Three things about this exception matter, and all three are true at once:

What happens: the text you submit to research is sent to that provider, and its terms allow it to use and train on that text. We cannot promise otherwise for content sent to it.
How narrow it is: this applies only to the research/search surface, and only to what you submit to it. Research is off unless you choose it, each use is under its own express, logged consent, and you can revoke that consent at any time.
What it does not touch: using research does not change the training or data-use position for anything else. Your manuscripts, notes, coaching, drafting, voice, and every other feature remain covered by the unqualified promise above — we do not use them to train any AI model, and choosing to use research never weakens that guarantee over the rest of Your Content.

4. AI processing of Your Content

Certain features send Your Content (such as manuscripts, notes, and prompts) to third-party AI providers so they can generate coaching, feedback, or other AI output at your request. This means:

Your Content is transmitted to and processed by AI providers acting as our service providers; and
those providers may store and process Your Content outside Canada, including in the United States (see Section 6).

We select AI providers that offer terms limiting their use of submitted content to providing the service (for example, providers that do not use API-submitted content to train their models). We list our current AI providers in Section 5.

If you use the Community Showcase (public content)

The Community Showcase lets you publish work to a shared, public space. This is always your choice — nothing you create is public unless you publish it. If you do publish:

the work you publish and the author profile you create (your handle, display name, bio, and any links) become public — visible to other users and, for public pages, to anyone with the link;
other users can leave feedback, reviews, and votes, which are associated with their accounts;
reports you file and feedback you leave are associated with your account and used for moderation and abuse prevention; and
public content may be seen, copied, and shared by others. Unpublishing or deleting stops further distribution by us but may not undo copies others have already made.

5. When we disclose information and our service providers (subprocessors)

We disclose personal information only as described here:

a. Service providers. We use trusted third parties to host, operate, and support the Service. They are authorized to process personal information only on our instructions and only to provide their service to us. Our current key service providers are:

Provider	Purpose	Primary data location
Fly.io	Application hosting / infrastructure	United States / global
Neon	Database hosting (account data, Your Content)	United States
Anthropic	AI inference (processing Your Content)	United States
Google	AI inference (processing Your Content)	United States / global
Stripe	Payment processing	United States / Canada
Cloudflare	Content delivery, security, email receiving, and object storage of uploads and media (Your Content)	Global
Resend	Transactional email delivery	United States
Axiom	Application logging and diagnostics	United States
PostHog	Product analytics — usage events and identifiers, never Your Content	United States
Upstash	Rate limiting and caching — identifiers only, never Your Content	Not published in our configuration
API Hero Ltd (Trigger.dev)	Scheduled background jobs	Not published by the provider
Voyage AI Innovations, Inc.	Text embeddings that power search and the knowledge features	Not published by the provider
AlphaAI Technologies Inc. dba Tavily	Web search for the research features	United States

We may update this list as our providers change; the current list will be maintained in this Policy.

Background jobs (Trigger.dev). API Hero Ltd operates our scheduled background jobs. Its privacy policy permits use of data for research and development, including developing AI, so we limit what it can reach by design rather than relying on that policy: our jobs carry no Your Content in their payloads — each one queries our database directly for what it needs. We note plainly that those jobs execute on the provider's infrastructure with database access, so content may transit their compute even though it is never placed in a job payload.

Data-use position of the embeddings provider (Voyage AI). Voyage AI Innovations, Inc. receives the text we embed — not just the resulting vectors. Its standard terms would permit it to train on submitted content by default, so we have opted out of that provision, which its terms describe as meaning content we send after the opt-out is deleted once it has been processed for us. The opt-out has been in effect since 16 August 2026. This is why Voyage is not an exception to the promise in Section 3: your content is not used to train its models.

We do not state a processing region for Voyage because the provider does not publish one, and we will not publish a location we have not confirmed. Its incorporation in the United States is not the same thing as a processing location. We have asked Voyage to confirm this in writing and will update this table when they do.

⚠️ Data-use position of the research/search provider (Tavily). Unlike the other providers above — which we select for terms that limit their use of submitted content to providing the service — AlphaAI Technologies Inc. dba Tavily (New York, United States) reserves broader rights over what is submitted to it. Its Terms of Service §6.5 permit Tavily to use Customer Input to train, improve and develop AI models, and §9.2 grants Tavily a perpetual, irrevocable licence covering derivative works and the improvement of its other products; its privacy policy states that query data may be used to improve future responses. Neither document draws a distinction between free and paid plans, so upgrading a plan does not change this. This is why research is a separate, opt-in surface with its own express, revocable consent (Section 3): it is the one place where text you submit may be used to train AI.

b. Sharing at your direction. When you use publishing, sharing, or export features, we disclose the relevant Content to the destinations or audiences you choose.

c. Legal and safety. We may disclose personal information where required or permitted by law — for example, to comply with a court order, lawful request, or to protect the rights, safety, and property of users, the public, or us.

d. Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to appropriate confidentiality protections.

6. Storage and cross-border transfer

Your personal information, including Your Content, may be stored and processed outside British Columbia and Canada, including in the United States, by us and our service providers listed above. While personal information is located in another jurisdiction, it may be subject to the laws of that jurisdiction, including lawful access requests by courts, law enforcement, and government authorities. We take reasonable contractual and technical measures to protect personal information consistent with this Policy and PIPA. If you have questions about our cross-border handling of personal information, contact our Privacy Officer (Section 1).

7. Retention

We retain personal information only as long as necessary for the purposes described in this Policy, to provide the Service, and to meet legal, accounting, and security requirements. When you delete Your Content or your account, we will delete or de-identify the associated personal information within a reasonable period, except that residual copies may persist in encrypted backups for a limited time and information may be retained where required by law or to resolve disputes and enforce our agreements. If you turn off writing-activity and document-lineage tracking (Section 2g) — for your whole account or for a single project — we stop collecting it and can delete the data already gathered for you. You may also choose how long we keep that data, or delete it outright, without turning collection off. We also close and delete accounts that have been inactive for two years, after making at least three attempts to reach you at the email address on the account, as described in Terms Section 8.4. Apart from that, we do not currently delete Your Content on a schedule to reclaim storage; it is removed when you ask us to remove it. We may introduce retention limits in the future, on reasonable advance notice and applying only going forward.

8. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information against loss, theft, and unauthorized access, use, or disclosure — including encryption in transit, access controls, and hashed credentials. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach that creates a real risk of significant harm, we will notify affected individuals and applicable authorities as required by law.

9. Cookies, analytics, and your choices

Strictly necessary and functional. We use cookies and similar local-storage technologies that are strictly necessary to operate the Service — such as keeping you signed in — and functional ones that remember your preferences, such as your theme.

Analytics. In the signed-in application we also set a first-party analytics cookie and use local storage to hold the pseudonymous identifier described in Section 2h, so that repeated visits can be recognised as the same person and a feature can be measured over time. Our public website sets no analytics cookie at all — analytics storage is switched off there, and nothing we set on that site persists after you leave it.

No advertising, no cross-site tracking. We use no advertising cookies, no third-party ad networks, and no cross-site tracking or ad-retargeting pixels. We do not sell your personal information, and we do not use your information for third-party advertising. We use operational logging (Section 2d) for diagnostics and security rather than advertising.

Your choices. You can clear or block cookies through your browser settings, and browser privacy features that block analytics scripts will prevent this collection — though disabling strictly necessary cookies may affect how the Service works. You may also ask us to stop processing your product-analytics data, or to delete it, by contacting our Privacy Officer (Section 10).

10. Your privacy rights

Subject to legal limits, you have the right to:

Access the personal information we hold about you and receive information about how it has been used and disclosed;
Correct inaccurate or incomplete personal information;
Withdraw consent to our collection, use, or disclosure of your personal information (subject to legal or contractual restrictions and reasonable notice) — withdrawing consent may mean we can no longer provide some or all of the Service; and
Delete your account and Your Content, as described in Section 7.

To exercise these rights, contact our Privacy Officer at privacy@oghmere.com. We will respond within the timeframe required by PIPA (generally 30 days) and may need to verify your identity first. If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner for British Columbia (OIPC):

OIPC BC — www.oipc.bc.ca · PO Box 9038 Stn Prov Govt, Victoria, BC V8W 9A4 · 1-800-663-7867

11. Children's privacy

The Service is available to users 13 years of age and older. If you are between 13 and the age of majority in your jurisdiction (19 in British Columbia), you may use the Service only with the consent and involvement of a parent or legal guardian. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, contact us at privacy@oghmere.com and we will take reasonable steps to delete it.

12. International users

The Service is operated from Canada. If you access it from outside Canada, you understand that your personal information will be transferred to, stored, and processed in Canada, the United States, and other countries where we and our service providers operate, which may have different data-protection laws than your country. Where required by applicable law in your jurisdiction, we will provide additional rights or protections; contact our Privacy Officer for more information.

13. Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice (for example, by email or in-Service notice) before they take effect and update the "Last updated" date above. Your continued use of the Service after changes take effect means you accept the updated Policy.

14. Contact us

For any privacy question, request, or complaint:

Privacy Officer — 1600978 B.C. LTD. (carrying on business as Oghmere)
Suite 1008
3003 Grandview Hwy, Unit 1
Vancouver, BC
Canada
V5M 2E4
Email: privacy@oghmere.com